T09 · Insecure Skill Coding Practices
Error
- Location
- config.env:6
- Finding
- TLS Certificate Verification Disabled for IMAP and SMTP<![CDATA[ ## Vulnerability Details **File Location**: `config.env:6-13` **Vulnerability Type**: Improper certificate validation **Risk Level**: High ### Vulnerable Code ```env IMAP_REJECT_UNAUTHORIZED=false IMAP_MAILBOX=INBOX SMTP_HOST=smtp.mail.yahoo.com SMTP_PORT=465 SMTP_SECURE=true SMTP_USER=aabjj93@yahoo.com SMTP_FROM=aabjj93@yahoo.com SMTP_REJECT_UNAUTHORIZED=false ``` ### Technical Analysis The active bundled configuration explicitly disables certificate verification for both IMAP and SMTP. Although encryption is enabled, setting `rejectUnauthorized` to `false` causes the clients to accept certificates that are self-signed, expired, issued for a different host, or signed by an untrusted authority. These values are consumed by `scripts/config.js` and passed into the IMAP and Nodemailer TLS configurations. Consequently, the clients do not authenticate the identity of the remote mail server. The ability to configure custom mail servers and self-signed certificates is consistent with the Skill's functionality, but disabling verification in the distributed default configuration is not necessary and exceeds an acceptable security baseline. ### Attack Path 1. A user runs the Skill with the bundled configuration. 2. The user connects through a network controlled or influenced by an attacker, such as a malicious access point, compromised router, or poisoned DNS resolver. 3. The attacker redirects the IMAP or SMTP connection to an attacker-controlled endpoint. 4. The endpoint supplies an invalid or attacker-generated certificate. 5. Because certificate verification is disabled, the Skill accepts the certificate. 6. The client authenticates to the malicious endpoint, exposing the email username and password or app password. 7. The attacker can also observe or modify incoming and outgoing email data. ### Impact Assessment A network-positioned attacker could obtain email credentials, read intercepted email content, capture outgoing messages and attachments ...[truncated 152 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Set both certificate-verification options to secure defaults: ```env IMAP_REJECT_UNAUTHORIZED=true SMTP_REJECT_UNAUTHORIZED=true ``` - Do not distribute active configuration with certificate verification disabled. - For private servers requiring a custom certificate, install the relevant private CA certificate and configure the client to trust that CA instead of disabling all verification. - If an insecure override must remain available, require an explicit per-account opt-in and display a prominent warning describing the credential interception risk. - Consider rejecting insecure settings for public mail providers such as Yahoo, Gmail, and Outlook. ]]>